// @vitest-environment node
import {expect,it} from 'vitest'
import {randomUUID} from 'node:crypto'
import {parseRunnerConfiguration} from '../../src/runner/config'
const config={protocol:1,runnerId:randomUUID(),token:'secret-fixture-'.repeat(3),serverURL:'https://example.invalid',hermesURL:'http://127.0.0.1:9119',allowedProfiles:['default'],artifactRoots:[]}
it.each([
  {serverURL:'http://example.invalid'},
  {serverURL:'https://user:password@example.invalid'},
  {serverURL:'https://example.invalid/path'},
  {hermesURL:'http://host.docker.internal:9119'},
  {hermesURL:'http://user:password@127.0.0.1:9119'},
  {artifactRoots:['relative/path']},
  {allowedProfiles:['../default']},
  {protocol:2},
  {command:'/bin/sh'},
])('rejects invalid or expanded node configuration without echoing credentials (%j)',patch=>{
  expect(()=>parseRunnerConfiguration({...config,...patch})).toThrow()
  try{parseRunnerConfiguration({...config,...patch})}catch(error){expect(String(error)).not.toContain(config.token);expect(String(error)).not.toContain('password')}
})
it('accepts explicit LAN opt-in and keeps service credentials in the private configuration',()=>{
  expect(parseRunnerConfiguration({...config,serverURL:'http://192.168.1.2:15300',allowInsecureLan:true,hermesCredentials:{username:'fixture',password:'private'}})).toMatchObject({allowInsecureLan:true,hermesCredentials:{username:'fixture',password:'private'}})
})